etherfidrop[.]xyz

Analysis of etherfidrop.xyz indicates that the domain was registered on 28 September 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.96.3 located in the United States. The domain resolves to two Cloudflare nameservers, beau.ns.cloudflare.com and kehlani.ns.cloudflare.com, and does not present an SSL certificate, which is typical for fraudulent landing pages. The page title retrieved from the site is “Un instant…”, and the underlying campaign is associated with an Airdrop Scam kit, suggesting an attempt to lure victims with a cryptocurrency airdrop narrative. VirusTotal has recorded seven detections out of ninety‑five scanning engines, confirming that multiple security products consider the site malicious.

The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, reinforcing the classification as a brand‑impersonation campaign targeting EtherFi. Gridinsoft assigns a trust score of zero out of one hundred, indicating a complete lack of legitimacy. The current operational status is offline, which may be the result of takedown actions or temporary suspension. Uncertainties remain regarding the exact content served before the takedown, as no HTTPS handshake was observed and the site’s visual elements have not been captured.

Defenders should continue to block the domain at perimeter filters, update DNS blacklists with the listed IP address and nameservers, and monitor for any re‑registration attempts that reuse the same registrar or similar naming patterns. Additional scrutiny of inbound traffic to Cloudflare‑hosted IP ranges associated with this domain is advisable, as adversaries may shift to adjacent IPs within the same ASN. Organizations using EtherFi services should educate users about unsolicited airdrop offers and enforce multi‑factor authentication to mitigate credential compromise.